1
00:00:00,201 --> 00:00:01,521
So I am Dawn Ely.

2
00:00:01,561 --> 00:00:03,681
I'm the Director of Enterprise Services for Cirrus.

3
00:00:03,681 --> 00:00:09,801
So Enterprise Services encompasses executive strategy, workforce, operational excellence, and supply chain.

4
00:00:10,321 --> 00:00:11,641
to be with you here today.

5
00:00:11,961 --> 00:00:13,121
And I'm your room monitor.

6
00:00:13,121 --> 00:00:15,321
If you need anything in the room, I'll be here for you.

7
00:00:15,321 --> 00:00:24,121
And also when we do any Q&A sessions, I will be using my long stride length to get to you quickly with the microphone so we can make sure that we capture that on the recording.

8
00:00:24,681 --> 00:00:28,681
I'm going to turn it over to Dave Mahusky to introduce our next speaker.

9
00:00:28,801 --> 00:00:29,081
Dave.

10
00:00:30,121 --> 00:00:33,041
So I'm Dave Mahusky, co-founder of the Precision X Systems.

11
00:00:33,041 --> 00:00:35,561
So we are the premier sponsor for the AI Summit.

12
00:00:36,281 --> 00:00:37,401
Please go check out our booth.

13
00:00:37,401 --> 00:00:38,281
It's a fantastic booth.

14
00:00:38,281 --> 00:00:39,081
Go shoot the arrow.

15
00:00:39,401 --> 00:00:41,561
If you haven't seen it yet, go shoot the arrow and see what you can win.

16
00:00:42,081 --> 00:00:45,481
Okay, without further ado, so I'm going to introduce Aaron Warner.

17
00:00:45,481 --> 00:00:51,561
So our next speaker is a founder and chief executive officer at ProCircular.

18
00:00:52,041 --> 00:01:01,481
So it's an information security and privacy firm serving organizations across healthcare, higher education, manufacturing, and financial services.

19
00:01:02,481 --> 00:01:21,801
Prior to founding ProCircular, Aaron spent over 2 decades as a CIO and a CTO at Integrated DNA Technologies, where he led and protected complex technology environments with a global genomics research organization.

20
00:01:21,801 --> 00:01:30,921
He holds a CISSP and Security Plus certifications and is a member of the FBI and DHS

21
00:01:32,201 --> 00:01:33,961
Infragard Partnership.

22
00:01:34,121 --> 00:01:37,001
I don't think that's Federal Bureau of Investigations.

23
00:01:38,841 --> 00:01:41,481
I got to talk to those guys more often than I would like.

24
00:01:43,241 --> 00:01:47,481
So in today's session, Aaron's going to talk about shadow AI.

25
00:01:47,481 --> 00:01:52,041
So whenever everyone becomes a data leak waiting to happen, basically.

26
00:01:52,041 --> 00:01:58,201
So Aaron's going to examine the rapidly evolving risks of AI adoption.

27
00:01:58,761 --> 00:02:11,561
And then he will share practical insights on data exposure, regulatory implications, and how leaders can approach AI with a strategy that balances innovation and then also security.

28
00:02:12,521 --> 00:02:15,721
So please join me in welcoming Aaron Warner.

29
00:02:19,921 --> 00:02:20,521
Thank you, Nate.

30
00:02:21,321 --> 00:02:24,361
Can you guys hear me okay?

31
00:02:24,521 --> 00:02:25,241
so

32
00:02:26,761 --> 00:02:30,121
I was driving up here thinking about the shadow nose.

33
00:02:30,121 --> 00:02:35,721
That certainly dates me more than a little, but in this particular case, it's applicable.

34
00:02:36,601 --> 00:02:42,601
I don't know how I got it titled, whatever, how to make people feel terrible about IT.

35
00:02:42,601 --> 00:02:46,361
That's really not the point of this presentation.

36
00:02:47,161 --> 00:02:53,561
I think Shadow AI is very interesting, both as a former renegade

37
00:02:54,201 --> 00:02:56,601
IT guy that didn't follow rules.

38
00:02:56,601 --> 00:02:58,201
I still don't follow rules very well.

39
00:03:01,081 --> 00:03:15,561
And as a CIO in biotech with some very sensitive instrumentation and some really high-end intellectual property and a lot of really heavy dependence on uptime, it's a curious trade-off.

40
00:03:16,361 --> 00:03:19,721
Shadow IT and your classical IT.

41
00:03:20,121 --> 00:03:22,441
The crazy part is that often in shadow IT,

42
00:03:23,081 --> 00:03:30,601
Your best ideas came from that group of renegade pain in the ass employees who didn't do things the way they were supposed to.

43
00:03:31,001 --> 00:03:33,561
So you have a hell of a quandary here, right?

44
00:03:33,561 --> 00:03:39,561
Like, what do I do with the best and brightest in my organization that refuses to follow rules?

45
00:03:40,121 --> 00:03:52,361
And how do I get them to help me to do what I need to do and harness that capability rather than just telling them no until they quit and go somewhere else?

46
00:03:53,241 --> 00:03:59,201
Shadow AI is that on steroids and it's coming from all different directions.

47
00:03:59,201 --> 00:04:02,681
So I think it's a fascinating kind of intractable problem right now.

48
00:04:02,961 --> 00:04:04,281
It's a very today kind of thing.

49
00:04:06,081 --> 00:04:06,921
Me, yeah.

50
00:04:07,161 --> 00:04:10,761
I was the guy dumb enough to drag that thing up here last year.

51
00:04:11,001 --> 00:04:16,881
I was thinking about that coming up earlier today with Doug, and both of us had like our laptops.

52
00:04:16,881 --> 00:04:20,361
I'm like, this is a much smarter approach to doing a conference.

53
00:04:20,921 --> 00:04:24,121
The reason I included him is that he is reasonably smart.

54
00:04:24,961 --> 00:04:27,001
He's integrated into 11 labs.

55
00:04:27,001 --> 00:04:28,441
It's actually Vlad Tempish.

56
00:04:28,441 --> 00:04:32,281
So if you have a conversation with him, he's actually really kind of unpleasant.

57
00:04:32,281 --> 00:04:33,481
He's rude to my daughter.

58
00:04:33,881 --> 00:04:35,481
jaw moves and the whole 9 yards.

59
00:04:35,481 --> 00:04:39,961
So I like AI for vibe coding and Claude code and that kind of thing.

60
00:04:41,401 --> 00:04:50,041
In cybersecurity work, obviously it's really changed how we do what we do and frankly why we do what we do.

61
00:04:51,081 --> 00:04:52,761
This is some stuff about ProCircular.

62
00:04:52,761 --> 00:04:55,321
We do offense and defense and that sort of thing.

63
00:04:55,561 --> 00:05:02,521
Incident response is usually when I'm on the phone with the Bureau, hey, we have this bad guy and they look this way or that way.

64
00:05:02,961 --> 00:05:03,881
What are you seeing?

65
00:05:04,041 --> 00:05:06,521
That's a pretty common conversation with those folks.

66
00:05:07,001 --> 00:05:12,801
So we do cybersecurity, and it gives us an interesting view into this sort of artificial intelligence world.

67
00:05:15,241 --> 00:05:19,001
The fastest growing security risk is definitely not an attacker.

68
00:05:19,001 --> 00:05:22,121
It's something your own people are doing to be helpful.

69
00:05:22,121 --> 00:05:24,281
And I think that's a really important part of this.

70
00:05:25,521 --> 00:05:31,481
IT directors, CIOs, anybody in a decision-making capability tend to view users as

71
00:05:32,201 --> 00:05:42,361
pissance or a pain or something that you just have to keep track of, it's easy to lose track of the fact that those are the sources of most of the innovation in the organization.

72
00:05:42,361 --> 00:05:44,281
And again, I'll come back to it.

73
00:05:44,601 --> 00:05:51,961
Typically, a lot of your larger pain in the ass employees are the ones who are able to contribute the most.

74
00:05:53,481 --> 00:05:55,161
So what do your people do?

75
00:05:55,241 --> 00:05:58,521
This is really how what we see in the real world.

76
00:05:58,521 --> 00:05:59,241
There are

77
00:05:59,881 --> 00:06:08,681
many, many presentations on how to properly implement Microsoft stack, the Copilot stack.

78
00:06:08,681 --> 00:06:13,481
There's plenty of guidance, or some of it at least, in enterprise things like Claude.

79
00:06:13,801 --> 00:06:17,801
But for the time being, like today, this is a total train wreck.

80
00:06:17,961 --> 00:06:29,001
And what we're seeing in organizations is people pasting whatever the hell they want into GPT, AI browsers that nobody, browser extensions that nobody's approved,

81
00:06:29,721 --> 00:06:33,081
automated no code tools, you see all that sort of thing.

82
00:06:33,481 --> 00:06:36,921
And everything on the left, how about this?

83
00:06:36,921 --> 00:06:42,201
How about by show of hands, how many of you are guilty of 1 or all of those things on the left?

84
00:06:43,841 --> 00:06:45,161
Yeah, right.

85
00:06:45,721 --> 00:06:46,601
Kind of defines this.

86
00:06:46,601 --> 00:06:48,601
It's part of how you end up at this conference.

87
00:06:50,361 --> 00:06:56,041
The other interesting piece of this, and this wasn't happening back in shadow IT days,

88
00:06:57,401 --> 00:07:01,081
is that a lot of these features are turning on whether you like it or not.

89
00:07:01,481 --> 00:07:04,841
Things inside of your CRM have become very, very smart.

90
00:07:04,841 --> 00:07:07,961
Things inside of your HRIS become very smart.

91
00:07:08,601 --> 00:07:16,881
Anybody who's using QuickBooks, you can pop QuickBooks open and take a really good look at, geez, your cash flow looks good this quarter, you should do that.

92
00:07:16,881 --> 00:07:18,041
That's all AI.

93
00:07:18,041 --> 00:07:21,561
And often it's not something you opted into.

94
00:07:22,041 --> 00:07:24,121
It happens inside of the application.

95
00:07:24,121 --> 00:07:24,441
So

96
00:07:24,921 --> 00:07:37,001
No matter how tight your controls are around whatever is happening on the left here, no matter how badly you try to put the screws to employees, all of these other things are going to continue to happen.

97
00:07:38,921 --> 00:07:40,841
Here's some interesting IBM data.

98
00:07:41,481 --> 00:07:47,321
Something like 97% of AI-related breaches lacked a proper AI access controls.

99
00:07:47,561 --> 00:07:50,201
I don't know what proper access controls look like.

100
00:07:50,201 --> 00:07:51,641
I think I need to go call Pella.

101
00:07:51,641 --> 00:07:53,481
It sounds like he's doing some

102
00:07:53,881 --> 00:07:55,721
fascinating things in that perspective.

103
00:07:55,721 --> 00:07:58,681
But again, what's that one?

104
00:07:59,081 --> 00:08:00,961
I just, I always think about the edge case.

105
00:08:00,961 --> 00:08:05,561
What's that one really brilliant guy in manufacturing who has a copy of Claude code?

106
00:08:05,561 --> 00:08:07,241
Like, what's that dude up to?

107
00:08:07,721 --> 00:08:10,281
That guy in shadow AI world.

108
00:08:11,001 --> 00:08:17,961
has the resources that somebody in shadow IT 20 years ago would have been like 30 people gone rogue.

109
00:08:18,201 --> 00:08:25,561
Now it's one guy, a really great piece of software to build the thing that they need to get that out the door this week.

110
00:08:25,721 --> 00:08:27,081
Best of intentions, right?

111
00:08:30,201 --> 00:08:35,801
Other interesting piece of this, and we're seeing this from a cybersecurity perspective,

112
00:08:36,201 --> 00:08:39,081
Fishing volume, voice fishing, audio.

113
00:08:39,241 --> 00:08:40,481
We've seen a few of those.

114
00:08:40,481 --> 00:08:45,721
In fact, I was on the phone last week because here's a little tip.

115
00:08:46,121 --> 00:08:51,401
DPRK, our friends in North Korea, are really busy trying to get jobs here in Iowa.

116
00:08:51,401 --> 00:08:54,681
I've had three of them in the last month.

117
00:08:55,801 --> 00:08:57,921
Person A interviews for the job.

118
00:08:58,521 --> 00:09:02,121
Person B, person A applies for the job.

119
00:09:02,121 --> 00:09:03,641
Person B interviews for the job.

120
00:09:03,641 --> 00:09:04,921
Person C shows up.

121
00:09:05,481 --> 00:09:08,441
Person C is not person A or B.

122
00:09:08,921 --> 00:09:13,561
Meanwhile, Pella, I'll pick on him, thought they were hiring one person.

123
00:09:13,561 --> 00:09:15,081
There are three folks involved.

124
00:09:15,481 --> 00:09:19,241
One of them is the guy you do not want in your organization.

125
00:09:19,241 --> 00:09:20,881
That is a North Korean spy.

126
00:09:20,881 --> 00:09:24,841
I'll go off on this a little bit.

127
00:09:25,881 --> 00:09:31,481
In one particular case, they hired an individual as an IT help desk person.

128
00:09:32,641 --> 00:09:33,961
Think about that for a moment.

129
00:09:33,961 --> 00:09:41,161
Like, if you've got a bad guy in your computer system, what kind of keys does a help desk have to have to do their job, right?

130
00:09:41,241 --> 00:09:41,961
That's tough.

131
00:09:42,521 --> 00:09:45,561
Even worse than that, another one was a development position.

132
00:09:45,641 --> 00:09:48,921
Like, they write all the core code for this organization.

133
00:09:48,921 --> 00:09:49,881
It's a manufacturer.

134
00:09:50,441 --> 00:09:53,961
That's another place you really don't want a bad guy hanging out.

135
00:09:54,201 --> 00:09:56,681
We caught one of them by photo.

136
00:09:56,761 --> 00:10:02,161
We did get him to show up for a Teams meeting, and we got a picture, and

137
00:10:02,601 --> 00:10:05,961
work with the people who do those things, and it's that guy.

138
00:10:06,521 --> 00:10:08,521
In the other case, we tracked it down.

139
00:10:10,601 --> 00:10:14,281
He forgot to turn his VPN on, and they showed up in Lahore, Pakistan.

140
00:10:15,641 --> 00:10:17,641
People make mistakes, even hackers.

141
00:10:17,961 --> 00:10:23,401
So anyway, that's the sort of weird thing, the weird world that I live in.

142
00:10:24,041 --> 00:10:32,041
And AI is making cybersecurity attacks much easier, much deeper, and more

143
00:10:33,161 --> 00:10:33,801
vibrant.

144
00:10:33,881 --> 00:10:36,041
They are all about customer delight.

145
00:10:36,041 --> 00:10:37,641
They have figured that shit out.

146
00:10:39,401 --> 00:10:47,561
And the number of attacks that you can implement is sort of limitless, dependent upon how much time you have to design.

147
00:10:47,561 --> 00:10:54,601
So these attacks are becoming as real as anything anybody has really sent you.

148
00:10:56,281 --> 00:10:59,801
Full disclosure, I fell for one last week.

149
00:11:00,441 --> 00:11:06,441
You might know, Elaine Chen is a woman who works at a really large law firm in Hong Kong.

150
00:11:06,601 --> 00:11:09,641
And I got an e-mail from her saying, hey, we really like your practice.

151
00:11:09,641 --> 00:11:10,241
We love to work.

152
00:11:10,361 --> 00:11:12,201
work with you, cybersecurity firm.

153
00:11:12,201 --> 00:11:15,161
This is a, she's like a heavy hitter in our industry.

154
00:11:15,641 --> 00:11:22,321
Emailed her back, Elaine, thank you so much for taking interest in Procircular and so on and so forth.

155
00:11:22,321 --> 00:11:28,841
And then I get an e-mail from our DCO group like 2 minutes later, like, hey, boss, that's not Elaine.

156
00:11:29,161 --> 00:11:30,441
That's this other thing.

157
00:11:30,521 --> 00:11:32,361
It wasn't easy to catch.

158
00:11:33,241 --> 00:11:35,721
But I fell for it, and I do this stuff for a living.

159
00:11:35,761 --> 00:11:38,041
Imagine what my grandparents are up to, right?

160
00:11:38,041 --> 00:11:43,321
So it's a perfect example of this kind of AI attack.

161
00:11:43,641 --> 00:11:45,641
They knew that I was a CEO.

162
00:11:46,081 --> 00:11:48,201
They knew that I owned a cybersecurity company.

163
00:11:48,361 --> 00:11:55,961
They knew that I did, and they mentioned very specifically what's called panel work within the insurance industry to do incident response.

164
00:11:56,601 --> 00:11:58,721
How the hell it figured that out, I don't know.

165
00:11:58,721 --> 00:12:02,121
There are many people in our company that couldn't have written that e-mail.

166
00:12:03,001 --> 00:12:05,321
Somebody out there did, and they did it with AI.

167
00:12:05,321 --> 00:12:11,641
And then I got another one from another legal scholar from a different law firm the following week.

168
00:12:12,041 --> 00:12:13,321
Same bad guys for sure.

169
00:12:13,561 --> 00:12:20,041
But it's just fascinating how well they can design these things and how quickly they can implement them.

170
00:12:20,041 --> 00:12:23,641
So I don't have all good news to share.

171
00:12:24,121 --> 00:12:24,601
Sorry.

172
00:12:26,921 --> 00:12:27,721
Three vectors.

173
00:12:28,521 --> 00:12:32,601
You got your employees who are pasting things and copying

174
00:12:34,441 --> 00:12:41,881
P&Ls and design documents from customers and all sorts of things into this hole that is AI.

175
00:12:42,841 --> 00:12:44,241
You have some vendor embedded AI.

176
00:12:44,241 --> 00:12:45,081
I mentioned that.

177
00:12:45,081 --> 00:12:47,721
Your CRM and HR systems are full of it now.

178
00:12:48,601 --> 00:12:56,441
Where those data go is a question for each one of those vendors and very likely a different answer from each one of those vendors.

179
00:12:56,921 --> 00:13:01,481
EC2 is not an acceptable answer and it's rarely going to be that straightforward.

180
00:13:02,521 --> 00:13:03,641
and autonomous agents.

181
00:13:03,641 --> 00:13:16,361
And this is the thing that you're hearing more and more often here at the conference where we've had a conversation with HR about how to register agents as employees, because in some cases we're going to need to track them.

182
00:13:16,521 --> 00:13:29,401
There are some in cybersecurity, there are some jurisdictional or geographic topics related to like when a bad thing happens, you have to let people know in a certain geographic area.

183
00:13:30,441 --> 00:13:35,641
where we locate some of this stuff can affect how some of that law reads.

184
00:13:35,721 --> 00:13:37,081
It's going to get awesome.

185
00:13:37,881 --> 00:13:41,561
Send your kids to law school and have them specialize in AI.

186
00:13:41,641 --> 00:13:43,561
They will be busy forever.

187
00:13:44,281 --> 00:13:46,841
And then you can go borrow their boat or something.

188
00:13:48,601 --> 00:13:50,361
So where does it hurt most?

189
00:13:50,361 --> 00:13:52,521
This isn't going to surprise anybody in this room.

190
00:13:53,241 --> 00:13:55,561
Healthcare, that's the obvious one.

191
00:13:56,281 --> 00:13:57,321
Here's a question.

192
00:13:58,041 --> 00:14:01,321
Why do hackers steal healthcare records?

193
00:14:01,321 --> 00:14:04,521
So we all know they do it, right?

194
00:14:05,001 --> 00:14:05,121
Why?

195
00:14:05,121 --> 00:14:07,561
I'll go one step further.

196
00:14:07,561 --> 00:14:19,121
Why is a healthcare record, PHI, worth 300 bucks for one account and a credit card is worth, if it's fresh, maybe 10, if it's old, maybe $2?

197
00:14:20,041 --> 00:14:21,001
Why the differential?

198
00:14:21,601 --> 00:14:24,761
What are they doing with the healthcare record, anyone?

199
00:14:25,801 --> 00:14:27,001
Doug's not allowed to play.

200
00:14:27,961 --> 00:14:30,201
He actually quite literally wrote the book on the subject.

201
00:14:32,121 --> 00:14:34,761
Yeah, there's a lot of Medicare fraud.

202
00:14:35,001 --> 00:14:39,481
The other thing that we'll see is opioid crisis.

203
00:14:39,481 --> 00:14:40,761
It's a big part of this.

204
00:14:41,561 --> 00:14:54,441
People will go take your identity, register you at five or six shady pharmacies, get your 150 opioid oxy

205
00:14:55,161 --> 00:15:01,001
OxyContin delivered, and then they go sell those in suburbia for about 100 bucks a pill.

206
00:15:01,801 --> 00:15:05,801
If you're hooked and you don't know where to call to get heroin, you'll spend whatever.

207
00:15:06,601 --> 00:15:08,281
And that is not lost on the bad guys.

208
00:15:08,281 --> 00:15:17,241
So part of the reason your medical records are so valuable is that you can get that one record and turn it into, in less than a week, thousands of dollars.

209
00:15:17,721 --> 00:15:21,001
So that's part of the reason healthcare is hit so hard.

210
00:15:21,721 --> 00:15:25,641
Financial services, I mean, that's the age-old, why do you steal from banks?

211
00:15:25,641 --> 00:15:26,681
That's where the money is.

212
00:15:28,521 --> 00:15:30,201
And manufacturing.

213
00:15:30,681 --> 00:15:41,241
I think the manufacturing one is a little bit distinct, perhaps, from these other two in the case, I come from high speed, high transactional volume manufacturing.

214
00:15:41,401 --> 00:15:43,241
Uptime is the thing.

215
00:15:43,641 --> 00:15:48,361
That is the lever that bad guys use against you in any situation they can.

216
00:15:48,601 --> 00:15:49,961
They know you have to ship.

217
00:15:50,361 --> 00:15:55,401
And they know it's very, very expensive when people are standing around staring at each other.

218
00:15:55,401 --> 00:16:00,361
So manufacturing, it tends to be a temporal lever that they use to cause trouble.

219
00:16:02,521 --> 00:16:13,961
And I should mention this, and Doug's talk has quite a bit more on the legal aspects of this than mine, but I'll generalize it this way.

220
00:16:15,281 --> 00:16:26,281
When governments get nervous about a thing, which is usually because their constituents are complaining about it, or they don't have a good answer for the question, they create legislation.

221
00:16:26,921 --> 00:16:30,601
Part of the problem with legislation, yes, that's cynical, but it's also true.

222
00:16:31,001 --> 00:16:34,761
I'm the author of like 3 bills, so I got to see all this firsthand.

223
00:16:37,881 --> 00:16:45,081
Legislation, particularly that legislation around technology, is almost immediately outdated when it's passed.

224
00:16:45,081 --> 00:16:54,281
There are, if you look through IO code, all kinds of stuff that was a sort of response to the social media MySpace revolution, right?

225
00:16:54,361 --> 00:16:57,281
But those laws don't just evaporate after they've been passed.

226
00:16:57,281 --> 00:17:00,761
They hang around and they...

227
00:17:00,761 --> 00:17:05,081
AI legislation is being discussed in every state in the union, including this one.

228
00:17:05,321 --> 00:17:05,961
It is

229
00:17:06,441 --> 00:17:13,081
I am not involved with Technology Association of Iowa or the Legislative Committee, so this is not the thoughts or opinions of that organization.

230
00:17:14,521 --> 00:17:15,401
It's a train wreck.

231
00:17:16,041 --> 00:17:17,081
It's it.

232
00:17:17,961 --> 00:17:28,441
Yeah, it's a yeah, I there are very smart people who I trust involved in trying to shape that legislation, and it is still a galactic train wreck.

233
00:17:28,481 --> 00:17:34,081
And the problem is it's legislators trying to.

234
00:17:34,881 --> 00:17:39,401
frame in a thing that is changing every day and that they don't understand.

235
00:17:39,561 --> 00:17:44,201
And it's probably, I don't know what end they're trying to seek.

236
00:17:44,201 --> 00:17:46,121
Good luck controlling it, right?

237
00:17:47,401 --> 00:17:53,881
So these are the places where a lot of this shadow AI really affects you the most.

238
00:17:55,081 --> 00:18:10,201
Your talk in earlier today, your keynote, mentioned a lot of the places in manufacturing where both the conflict of innovation and renegade sort of meet with one another.

239
00:18:10,201 --> 00:18:13,481
I think this is a really fascinating place where that happens.

240
00:18:14,921 --> 00:18:18,921
Three stories, you got to have your horror stories in this line of work, right?

241
00:18:20,121 --> 00:18:21,241
This is my story.

242
00:18:21,241 --> 00:18:22,681
This is a true story.

243
00:18:22,681 --> 00:18:24,121
Halloween sucked last year.

244
00:18:24,361 --> 00:18:28,441
I spent 2 1/2 years writing software to get my robots running.

245
00:18:28,761 --> 00:18:39,881
And the punchline here is that on Halloween night, I was using Visual Studio with Claude code integrated and a whole bunch of MCP connections, and it like choked.

246
00:18:40,041 --> 00:18:41,081
Just died.

247
00:18:41,801 --> 00:18:42,921
My code was solid.

248
00:18:43,321 --> 00:18:44,361
Passes all the Git.

249
00:18:45,161 --> 00:18:47,321
I import all the functional things work.

250
00:18:47,561 --> 00:18:50,681
Yeah, my design tool doesn't work, and then one thing broke.

251
00:18:51,561 --> 00:18:57,441
You find out very quickly where that dependency is, especially when you have trick-or-treaters waiting at your front door.

252
00:18:57,441 --> 00:18:59,801
You're like, God damn it, why can't I get this running?

253
00:19:00,201 --> 00:19:07,801
I spent the whole night swearing at my computer instead of watching my cool animatronics talk to kids and say fun stuff.

254
00:19:08,121 --> 00:19:14,881
So I had not worked out that dependency, you develop a really, really intense dependency on the tool or

255
00:19:15,001 --> 00:19:17,161
tool set that you're using.

256
00:19:17,881 --> 00:19:29,481
It used to be your dependency was on the people in the project itself or the technology that you're trying to deploy, Microsoft ERP or what have you.

257
00:19:29,641 --> 00:19:36,681
In this particular case, it's the tools you're using to build the tools is where you've moved the risk and they're delicate.

258
00:19:37,001 --> 00:19:43,961
MCP is delicate, authentication is delicate, integration of cloud code into Visual Studio.

259
00:19:44,361 --> 00:19:45,241
is delicate.

260
00:19:45,241 --> 00:19:58,521
So in some ways, we've kind of replaced the nice safe world of C and Visual Studio and sort of a well understood approach to computer software development with who knows.

261
00:19:59,881 --> 00:20:01,721
It generates major risk.

262
00:20:01,721 --> 00:20:04,681
And because of that, this is just me complaining.

263
00:20:04,761 --> 00:20:07,881
I had to sit and watch trick or treaters be disappointed.

264
00:20:09,161 --> 00:20:10,601
Here's an actual case.

265
00:20:11,641 --> 00:20:13,401
Drift sells a chat bot.

266
00:20:14,121 --> 00:20:16,121
that it integrates into SFDC.

267
00:20:17,001 --> 00:20:20,121
It holds really long OF tokens.

268
00:20:21,241 --> 00:20:28,281
They tagged Sales Hub's GitHub, moved into AWS, and walked out with all of the active customer tokens.

269
00:20:28,601 --> 00:20:33,481
And they used those customer tokens to log directly into Salesforce.

270
00:20:33,801 --> 00:20:38,601
That's just because that chatbot sort of slopped those tokens over.

271
00:20:39,961 --> 00:20:40,681
That's one.

272
00:20:41,401 --> 00:20:41,961
Asana.

273
00:20:42,761 --> 00:20:47,641
MCP, everybody, somebody, anyone familiar with MCP in here?

274
00:20:47,801 --> 00:20:53,921
Just generally speaking, MCP is kind of a cool new method of connecting up dissimilar systems.

275
00:20:53,921 --> 00:20:55,721
In this particular case, chatbots.

276
00:20:58,281 --> 00:21:01,561
It is a mixed blessing from a security perspective.

277
00:21:01,561 --> 00:21:09,241
It tends to be set up as like you get everything or you get nothing unless you're working in his environment.

278
00:21:09,401 --> 00:21:11,001
I'd love to see how that's set up.

279
00:21:11,801 --> 00:21:16,361
But MCP is a method of sharing data between systems.

280
00:21:18,201 --> 00:21:28,281
They set up an MCP, which everybody is doing, by the way, setting up an outbound MCP connection so you can plug Claude into it so you can ask whatever questions, right?

281
00:21:29,801 --> 00:21:36,281
Bit of a problem, caused cross-tenant access and customers could just query pretty much everything about any customer.

282
00:21:37,161 --> 00:21:38,361
That is a bad thing.

283
00:21:38,841 --> 00:21:46,441
I used to work in biotech, and let me tell you that DAO was very interested in what their competitors were doing.

284
00:21:47,001 --> 00:21:55,681
And if their competitors had figured out that DAO had access to the work I was doing at Integrated DNA, that would have been a very, very bad thing.

285
00:21:55,721 --> 00:21:59,081
Pfizer versus Wyeth, or take your pick, right?

286
00:21:59,401 --> 00:22:03,321
Customer A shouldn't be able to see customer B's data, bad day.

287
00:22:04,921 --> 00:22:05,641
Slack.

288
00:22:06,201 --> 00:22:10,241
So they added a, this is kind of funny, they added a paragraph to their privacy policy.

289
00:22:10,321 --> 00:22:16,121
policy saying, by the way, we analyze customer messages, content and files to develop AI.

290
00:22:16,761 --> 00:22:25,001
We probably threw that in on like a Tuesday, and I'm sure that everybody took careful care to read through their EULA and accepted that.

291
00:22:26,041 --> 00:22:34,041
Every workspace was defaulted, was opted in by default, and the opt out was an e-mail with a specific subject line.

292
00:22:34,761 --> 00:22:45,321
Nine months, they sat and consumed pretty much everybody's conversations in Slack on a number of topics, I'm sure.

293
00:22:46,121 --> 00:22:49,641
So when this breaks, this breaks big.

294
00:22:49,881 --> 00:22:58,641
And the data that are shared or made accessible aren't always, we talk a lot about like, well, what happens when you drop your data into

295
00:22:59,481 --> 00:23:03,961
the cloud, it's someone else's computer, or into GPT, and that's someone else's computer.

296
00:23:04,281 --> 00:23:06,361
That's really not what we're talking about here.

297
00:23:06,361 --> 00:23:13,481
We're talking about the vendors that you're using allowing outside people to view your data.

298
00:23:13,481 --> 00:23:17,001
This isn't even, Slack probably didn't mind this very much.

299
00:23:17,401 --> 00:23:21,161
I doubt they have reversed it, unless their lawyers had an opinion on it.

300
00:23:21,481 --> 00:23:28,601
They probably still have those graph tables laid around somewhere, because it would be super useful to know what people talk about on Slack.

301
00:23:29,881 --> 00:23:33,561
So when these things break, they tend to break big.

302
00:23:34,801 --> 00:23:35,881
What do they have in common?

303
00:23:36,761 --> 00:23:46,121
AI integrations, cross-tenancy, and cross-tenancy for anybody who's built those sorts of structures is very difficult to get right on a good day.

304
00:23:47,481 --> 00:23:58,281
Cross-tenancy leaks are becoming a huge category here, and default on AI changes, which is kind of how they get you to buy the product.

305
00:23:59,561 --> 00:24:04,961
They turn it on, they get you hooked on it, and then you need the $10 a month, whatever, subscription.

306
00:24:06,441 --> 00:24:16,521
Those default on changes, in addition to being a fiscal risk, also have some security implications as well, particularly when they're in the hands of employees.

307
00:24:17,161 --> 00:24:18,921
Here's a shadow IT example.

308
00:24:20,041 --> 00:24:25,401
I worked in a place that had a gene synthesis, so very cutting edge.

309
00:24:25,641 --> 00:24:27,961
We built whole genes for clients.

310
00:24:29,081 --> 00:24:33,641
Think like environmental sciences, think cancer cures and that sort of stuff.

311
00:24:34,681 --> 00:24:39,641
I found out, I was the CIO, I found out the hard way they're using this new piece of software called Trello.

312
00:24:40,001 --> 00:24:40,921
Anybody use Trello?

313
00:24:41,561 --> 00:24:50,201
Yeah, they had the whole frigging everything we were ever going to do in synthetic biology, which was very proprietary, right there in Trello.

314
00:24:50,201 --> 00:24:51,801
And by the way, it was the free.

315
00:24:55,641 --> 00:24:56,521
Shadow IT.

316
00:24:56,521 --> 00:24:58,841
That was, however, another example.

317
00:24:59,561 --> 00:25:13,001
Those pain in the ass employees went from a $4 million loss to a $35 million gain, a 60% net in three years when they got their shit together.

318
00:25:13,001 --> 00:25:16,601
So those renegades, those pain, they were a complete pain.

319
00:25:17,241 --> 00:25:21,241
They also revolutionized how the company did what it does.

320
00:25:21,561 --> 00:25:23,321
So good with the bad.

321
00:25:25,681 --> 00:25:27,801
What is the market doing about any of this?

322
00:25:29,721 --> 00:25:36,281
Paul was very upset with me for not submitting this presentation like, I don't know, three months ago or something.

323
00:25:38,281 --> 00:25:44,921
I submitted it last night at midnight, mostly because Microsoft was releasing some new things and there are a bunch of new changes.

324
00:25:45,001 --> 00:25:46,441
It's the nature of the industry, right?

325
00:25:46,441 --> 00:25:47,961
Some of this is in the last day.

326
00:25:50,041 --> 00:25:51,641
Data lineage, oops, did I miss?

327
00:25:54,521 --> 00:25:54,921
I'm sorry.

328
00:25:54,921 --> 00:25:57,321
So these are really the four different approaches.

329
00:25:57,321 --> 00:26:07,561
You can think of them as, rather than four different approaches, four different layers of security as it applies to how to secure and monitor agents within your environment.

330
00:26:08,041 --> 00:26:09,961
This is a very moving target.

331
00:26:09,961 --> 00:26:16,201
Like I said, Microsoft just released their version of this into production like last night.

332
00:26:16,361 --> 00:26:18,681
So super, super new stuff.

333
00:26:19,961 --> 00:26:22,841
Data lineage is about tracking where the data came from.

334
00:26:24,041 --> 00:26:26,281
It is also, I don't like that description.

335
00:26:26,281 --> 00:26:31,841
It's also more about tracking data where it exists as opposed to no matter where it exists.

336
00:26:31,841 --> 00:26:34,561
So data in transit as opposed to data at rest.

337
00:26:35,321 --> 00:26:39,401
Your data needs to know who it belongs to and where it belongs.

338
00:26:40,441 --> 00:26:45,321
That data lineage component is a really important part of building a security program around this.

339
00:26:45,881 --> 00:26:51,241
It also makes the assumption that you know what data you have and who owns it.

340
00:26:51,801 --> 00:26:52,441
Nobody

341
00:26:52,801 --> 00:26:53,401
does that.

342
00:26:53,401 --> 00:26:56,281
Data governance is very hard to do right.

343
00:26:56,281 --> 00:27:02,441
But if you can take a swing at it, data lineage is one of the methods of keeping track of the things that are happening within the organization.

344
00:27:03,081 --> 00:27:05,321
Endpoint discovery, you guys are used to EDR.

345
00:27:05,641 --> 00:27:10,601
You put little guys out that listen and tell you what people, what applications people are running.

346
00:27:12,601 --> 00:27:16,361
AISPM and runtime is sort of the inspection approach.

347
00:27:16,641 --> 00:27:18,441
It is not DLP.

348
00:27:18,441 --> 00:27:24,441
It's a little different than data loss prevention, classic data loss prevention, in that it tends to be integrated.

349
00:27:24,521 --> 00:27:29,641
There are a couple of ways to do this, but it tends to be integrated into the prompts themselves.

350
00:27:29,641 --> 00:27:33,481
The other big thing that a lot of these make the assumption of is VPN.

351
00:27:34,081 --> 00:27:39,241
If you have clients or if you have employees with VPNs inside, they can skip right over the top of a lot of this.

352
00:27:40,441 --> 00:27:41,961
And identity and gateways.

353
00:27:42,641 --> 00:27:51,401
I'll tell you the thing that keeps me up at night most about AI, the thing I think bad thoughts about more often than not is identity.

354
00:27:51,801 --> 00:27:53,881
I don't know how to do identity.

355
00:27:55,161 --> 00:27:58,081
And I work for a company where it's very, very important.

356
00:27:58,761 --> 00:28:02,121
I mentioned the YF doesn't need to see Pfizer's stuff.

357
00:28:02,521 --> 00:28:06,441
In my world, this customer does not need to see the recipe.

358
00:28:06,761 --> 00:28:08,681
for how to hack that customer.

359
00:28:08,761 --> 00:28:10,601
That would be good not to share.

360
00:28:10,921 --> 00:28:19,081
In order to separate those things, I have to know very well that person is who they say they are and this person is who they say they are.

361
00:28:19,481 --> 00:28:28,201
That is undiscovered country on the information superhighway and it is made far more complex by AI where you can fake it.

362
00:28:30,121 --> 00:28:31,081
Identity, identity.

363
00:28:31,081 --> 00:28:32,681
Then maybe that'll be my next talk.

364
00:28:34,281 --> 00:28:34,761
Yes, sir.

365
00:28:40,681 --> 00:28:41,801
I mentioned it.

366
00:28:42,121 --> 00:28:43,881
So I mentioned VPM.

367
00:28:43,881 --> 00:28:44,961
Is it a good safeguard to have?

368
00:28:44,961 --> 00:28:45,961
That's a good question.

369
00:28:47,081 --> 00:28:54,441
In this context, what I'm talking about is somebody inside of an organization hiding what they're up to with a VPN.

370
00:28:54,841 --> 00:28:57,481
Some IT shops will detect that, some won't.

371
00:28:57,801 --> 00:29:02,441
But if you have employees who are using VPNs internally inside of the environment,

372
00:29:03,401 --> 00:29:08,041
They can skip over some of the protections that you have in place to inspect their traffic.

373
00:29:08,201 --> 00:29:09,721
That's really what I was referring to here.

374
00:29:11,001 --> 00:29:13,161
VPNs in general, big fan.

375
00:29:14,521 --> 00:29:18,761
Big fan, although it's becoming increasingly difficult not to look like a spam bot.

376
00:29:19,241 --> 00:29:23,961
My Proton mail gets me kicked off of a lot of stuff, or Proton VPN.

377
00:29:25,721 --> 00:29:28,361
Three new releases, all within the last 30 days.

378
00:29:28,361 --> 00:29:30,121
It's actually like the last three days.

379
00:29:30,761 --> 00:29:34,361
Prompt security, Sentinel One bot prompt security is a fantastic tool.

380
00:29:35,081 --> 00:29:45,321
It allows you to take a look into real-time prompt injections so you can catch people who are trying to do bad things while they're doing it.

381
00:29:46,281 --> 00:29:55,561
SentinelOne also has the benefit of many, many years of XDR and EDR and all of the data that they have collected on threat intelligence.

382
00:29:55,641 --> 00:29:57,801
The same applies to CrowdStrike as well.

383
00:29:58,121 --> 00:30:04,521
So their models are pretty vertically trained to do just this one thing.

384
00:30:05,001 --> 00:30:06,601
SentinelOne only sells security.

385
00:30:07,001 --> 00:30:09,241
Microsoft, they sell a couple of other things.

386
00:30:09,401 --> 00:30:10,281
Toasters.

387
00:30:13,081 --> 00:30:16,601
Agent 365, that released yesterday.

388
00:30:16,601 --> 00:30:18,201
I have not played with it yet.

389
00:30:18,201 --> 00:30:22,521
I'd love to talk to anybody who got to play with it in pre-release because I didn't fiddle around with it.

390
00:30:24,121 --> 00:30:28,601
My guess, and that's because I'm old and definitely

391
00:30:29,721 --> 00:30:30,441
stubborn.

392
00:30:30,681 --> 00:30:35,561
Microsoft tends to release a product and then let us figure out how the hell it works.

393
00:30:37,001 --> 00:30:40,361
Microsoft Service Center is like my favorite, CIO's example of that.

394
00:30:40,361 --> 00:30:45,201
Here's a cool piece of software we can sell you that you can use to run your entire organization.

395
00:30:46,121 --> 00:30:49,441
Now configure it just like your organization.

396
00:30:49,441 --> 00:30:50,201
It's like, dude.

397
00:30:50,761 --> 00:30:52,201
You were supposed to do that.

398
00:30:52,441 --> 00:30:53,601
Why did I pay you $100,000?

399
00:30:55,241 --> 00:31:01,241
Microsoft is good at giving software out to the world that has functionality that you get to figure out how to use.

400
00:31:01,721 --> 00:31:03,321
I'm not holding my breath for that.

401
00:31:03,721 --> 00:31:09,001
The biggest advantage that this has right now, as far as I can tell, is that it's Microsoft.

402
00:31:09,081 --> 00:31:10,441
That's like their whole sales pitch.

403
00:31:10,441 --> 00:31:11,961
Well, it's good.

404
00:31:12,281 --> 00:31:13,161
Well, why is it good?

405
00:31:13,161 --> 00:31:16,121
Well, because it's Microsoft and it integrates into the Microsoft stack.

406
00:31:16,841 --> 00:31:17,161
Cool.

407
00:31:17,321 --> 00:31:18,361
Why else is it good?

408
00:31:18,761 --> 00:31:20,841
Well, your whole system is a Microsoft stack.

409
00:31:21,081 --> 00:31:23,241
It's like, yeah, that's awesome too.

410
00:31:23,241 --> 00:31:23,881
I know that.

411
00:31:24,201 --> 00:31:25,721
Why is it better than prompt?

412
00:31:26,041 --> 00:31:30,041
Well, we're integrated directly to your Exchange Server and Office 365.

413
00:31:30,121 --> 00:31:32,441
It's like, thanks.

414
00:31:33,561 --> 00:31:40,761
CrowdStrike has another set of really fascinating tools to sort of approach this.

415
00:31:40,921 --> 00:31:45,001
You can expect this to be the thing that everybody announces every quarter.

416
00:31:45,081 --> 00:31:46,521
There will be updates on this.

417
00:31:46,921 --> 00:31:55,881
If for no other reason, then probably the first step in getting your arms around this problem is to figure out how bad it is in your organization.

418
00:31:56,841 --> 00:31:59,721
Any one of those tools might give you some insight there.

419
00:31:59,881 --> 00:32:05,241
Certainly better insight than you have by sending an e-mail saying, hey, is anybody using Claude code?

420
00:32:07,161 --> 00:32:09,801
Hey, the guy using Claude code doesn't reply to that e-mail.

421
00:32:12,841 --> 00:32:14,841
and do you see this?

422
00:32:14,841 --> 00:32:16,041
is brand new too.

423
00:32:16,041 --> 00:32:17,001
E7.

424
00:32:17,721 --> 00:32:19,321
Apparently this is like 3 months old.

425
00:32:19,321 --> 00:32:20,641
I just found this last night.

426
00:32:20,641 --> 00:32:21,641
I'm like, oh shit.

427
00:32:22,361 --> 00:32:24,521
I didn't find the air fryer.

428
00:32:25,001 --> 00:32:26,281
I think it's one of those.

429
00:32:27,001 --> 00:32:33,961
But there is like everything under the sun in this package and it's only $99 per user per month.

430
00:32:34,921 --> 00:32:37,721
If it included Adobe Creative Suite, I might pay it.

431
00:32:37,961 --> 00:32:45,561
But yeah, so E7 is the new AI-ified version of the really expensive E5 license.

432
00:32:46,521 --> 00:32:47,641
Open your checkbooks.

433
00:32:49,001 --> 00:32:55,001
So if you're just starting, purview labels in Agent, you're already paying for that.

434
00:32:55,001 --> 00:33:01,561
That's one way to try that out to make sure that you can sort of detect where people reside within the organization.

435
00:33:02,561 --> 00:33:10,241
If you have CrowdStrike or Sentinel 1, that Shadow AI module, I think that it is still reasonably pre-release-ish.

436
00:33:10,441 --> 00:33:14,961
but you can beg them into, thank you, into giving them a look.

437
00:33:14,961 --> 00:33:17,961
Give me a call if you'd like to see it, because it's cool stuff.

438
00:33:19,401 --> 00:33:26,361
If you build AI applications in-house, SPM platforms, I'm going to recommend kind of a different approach to that.

439
00:33:26,361 --> 00:33:29,881
And if you're starting from zero, endpoint discovery.

440
00:33:30,041 --> 00:33:35,481
And I would tell you that just to protect your organization, if you don't have endpoint out there anyway, you should.

441
00:33:38,641 --> 00:33:44,681
The whole ecosystem, there's no shortage of new entrants in this, and there will continue to be.

442
00:33:44,681 --> 00:33:50,441
This is going to be a watching people use AI is going to be an important and popular part of what we do.

443
00:33:52,121 --> 00:33:55,081
And this was going to be my sort of punchline.

444
00:33:55,321 --> 00:33:57,321
Build a culture and not a cage.

445
00:33:57,481 --> 00:34:04,921
So I work with, I don't even know how many CIOs in my capacity in cybersecurity.

446
00:34:05,881 --> 00:34:17,281
Some of them care about culture, others less so, but they tend to be awfully prescriptive and skeptical of what their employees get up to.

447
00:34:18,761 --> 00:34:23,081
I would argue that you get a lot further by being open about the risks.

448
00:34:23,241 --> 00:34:30,841
You want people to understand why, not don't do this, but why don't you do this, or why would this be a problem?

449
00:34:32,041 --> 00:34:45,481
Sharing examples, telling the examples like that sales loft story so that people have a concrete example of why any of this stuff matters because that guy in shipping doesn't care unless you can give them something to really think about.

450
00:34:47,241 --> 00:34:49,321
Make the safe path the easiest path.

451
00:34:49,401 --> 00:34:53,401
So find a tool or a tool set and give it a budget.

452
00:34:55,321 --> 00:34:57,481
I got in big trouble with

453
00:34:58,441 --> 00:35:00,281
I know this is more #4.

454
00:35:00,281 --> 00:35:04,121
Train your people to protect the firm, not to fear breaking the rules.

455
00:35:05,721 --> 00:35:12,921
Think 1000 people making very cool custom DNA things and a lot of them very sharp and able to use technology.

456
00:35:13,321 --> 00:35:19,881
Our IT department, we owned, this will date me, 2 million lines of Delphi code, which is object-based Pascal.

457
00:35:20,521 --> 00:35:21,241
Go Delphi.

458
00:35:23,881 --> 00:35:29,001
We had this huge system up and running, and we started to notice that people were writing things against it.

459
00:35:29,001 --> 00:35:31,241
And we would see these queries run against production.

460
00:35:31,241 --> 00:35:33,241
Like, wow, what do you do in here?

461
00:35:33,641 --> 00:35:46,601
The IT team's response, particularly the DBAs, and I'm sorry if there are DBAs or whatever that is today in the room, freaked out, wanted to shut everybody off always because it's their DBAs and that's kind of their thing.

462
00:35:47,641 --> 00:35:49,721
Instead, I threw a conference.

463
00:35:49,961 --> 00:35:52,441
It got me in big trouble with the development team.

464
00:35:52,761 --> 00:36:01,241
I'm like, you guys, we're going to show them how to use production and how to query customer and how to query order and how to get access to all of these systems.

465
00:36:01,561 --> 00:36:06,441
And you're going to tell them how, because we want to bring these people into the fold.

466
00:36:06,601 --> 00:36:11,641
If you can show them, don't, instead of don't do it, show them how to do it right.

467
00:36:11,881 --> 00:36:14,561
You're bringing these folks to the organization.

468
00:36:14,561 --> 00:36:15,401
You're helping us to

469
00:36:15,881 --> 00:36:17,161
build and contribute.

470
00:36:17,161 --> 00:36:24,081
And frankly, those renegades that take the time to go cause trouble like that, they're not doing it just because they're a pain in the ass.

471
00:36:24,081 --> 00:36:25,001
They want to help.

472
00:36:25,001 --> 00:36:26,601
So let's harness that.

473
00:36:27,001 --> 00:36:31,721
This is no different, and those renegades' tools are so much better than they used to be.

474
00:36:32,121 --> 00:36:33,241
Bring them into the fold.

475
00:36:34,441 --> 00:36:37,401
Train them to protect the firm, show them how to do it right.

476
00:36:38,361 --> 00:36:40,601
Treat AI procurement like security review.

477
00:36:41,321 --> 00:36:46,201
Invite the security folks into the things that you're buying to make sure that they have an opinion.

478
00:36:46,521 --> 00:36:55,881
I would argue as well as a security guy, please mention to them their job is not just to say no, because they'll just do that.

479
00:36:56,921 --> 00:37:01,481
You know, I have an outcome and the outcome needs to outweigh

480
00:37:01,961 --> 00:37:05,081
the security implications of that, would be a good thing to work through.

481
00:37:05,081 --> 00:37:16,761
But inviting those folks to the conversation at least gets them involved in the purchasing so that they can't say, well, this department, they don't even pay attention to me because, you know, I wasn't even invited to that decision.

482
00:37:16,761 --> 00:37:19,241
So I rolled out this tool, Shadow AI.

483
00:37:20,041 --> 00:37:24,841
So I'm not saying Shadow AI is a bad thing at all.

484
00:37:24,841 --> 00:37:30,041
I think it's one of the most promising parts of companies growing

485
00:37:30,521 --> 00:37:31,161
in the future.

486
00:37:31,161 --> 00:37:36,681
It gives people a force multiplier technology that they've never had before.

487
00:37:36,681 --> 00:37:44,281
You just have to treat them like humans and treat them like contributors rather than a problem within the organization.

488
00:37:46,761 --> 00:37:50,121
Yeah, accept that it's being used and help people to use it right.

489
00:37:50,921 --> 00:37:51,921
So that's what I got.

490
00:37:51,921 --> 00:37:53,001
I don't know how I am on.

491
00:37:53,881 --> 00:37:56,121
Minutes left, so if we have any questions that we want to take.

492
00:37:56,601 --> 00:37:57,881
Oh, I'm headed away.

493
00:37:58,081 --> 00:37:59,121
Thank you for being patient.

494
00:38:01,801 --> 00:38:03,081
Thank you for the presentation.

495
00:38:03,641 --> 00:38:06,681
You talked about the pain in the ass renegades.

496
00:38:06,841 --> 00:38:08,521
I am that pain in the ass renegade.

497
00:38:08,601 --> 00:38:09,121
You go, man.

498
00:38:10,641 --> 00:38:19,401
What tips may you have for approaching, like I have many problems with the IT department, trying to figure out how to best interact so we can push innovation within the company.

499
00:38:19,401 --> 00:38:21,401
You seem to have a lot of experience with that.

500
00:38:21,401 --> 00:38:22,281
I would love to get your.

501
00:38:22,561 --> 00:38:23,321
I'll tell you the.

502
00:38:25,001 --> 00:38:27,761
I'll give you the formal answer and I'll give you the crafty answer.

503
00:38:27,761 --> 00:38:34,281
The formal answer is that you probably need to go find whatever change control.

504
00:38:34,441 --> 00:38:35,761
How large is the organization?

505
00:38:36,201 --> 00:38:37,001
You're Craig.

506
00:38:38,281 --> 00:38:42,921
OK, yeah, there'll be some group that decides on changes and so forth.

507
00:38:43,321 --> 00:38:45,401
I wouldn't go to the CIO.

508
00:38:47,081 --> 00:38:53,401
That woman or man's job is going to be to create and follow policy maybe more than

509
00:38:53,721 --> 00:39:09,161
foster innovation, I would go find somebody in development, somebody who's writing software in the organization, and get to be BFFs with that person so that then they can go up through their chain of command and say, hey, I've got this really smart guy over here who's writing stuff.

510
00:39:09,401 --> 00:39:10,481
Let's bring him into the fold.

511
00:39:11,801 --> 00:39:18,281
If you take that sort of bottom-up approach, most organizations, I would guess you'll have better luck than if you want to find

512
00:39:18,761 --> 00:39:22,041
Unless you're at Pella, you should go talk to talk to this.

513
00:39:22,121 --> 00:39:24,441
I'm so impressed with that presentation.

514
00:39:25,801 --> 00:39:28,761
Yeah, that would be that would be my the other thing.

515
00:39:30,561 --> 00:39:38,281
Executives like tangible examples showing like this is I wouldn't talk a lot about architecture.

516
00:39:38,521 --> 00:39:41,001
I probably were transformers or how you've got here.

517
00:39:42,121 --> 00:39:43,241
I would talk more about.

518
00:39:44,841 --> 00:39:47,721
outcomes, consider the audience.

519
00:39:47,721 --> 00:39:48,801
That's always the case.

520
00:39:48,801 --> 00:39:51,481
What is the person you're talking to care about?

521
00:39:52,041 --> 00:39:52,841
Speak to that.

522
00:39:53,121 --> 00:39:56,601
A little social engineering goes a long way in getting a budget justified.

523
00:39:56,601 --> 00:39:58,841
It's a good question.

524
00:40:00,281 --> 00:40:01,161
Other questions?

525
00:40:01,321 --> 00:40:03,561
Oh, you're going to make me earn my keep today.

526
00:40:03,561 --> 00:40:04,201
This is good.

527
00:40:09,771 --> 00:40:16,571
So I've tested a new software that just implemented a new AI feature to it.

528
00:40:17,881 --> 00:40:22,361
How would you go approaching putting governance on some of that stuff?

529
00:40:22,361 --> 00:40:24,201
Because it's built in.

530
00:40:24,201 --> 00:40:30,361
It's not like I can shut it off, but I can say you should shut it off until you're confident to use it.

531
00:40:30,441 --> 00:40:30,841
Sure.

532
00:40:30,841 --> 00:40:37,321
Is that more of a governance rule in your head or how do you approach it from a security risk?

533
00:40:37,641 --> 00:40:38,601
I think it.

534
00:40:39,401 --> 00:40:48,681
Ideally, the purchasing process would have included a review, or is this one of those like it just It just got implemented in the newer version of the software.

535
00:40:49,241 --> 00:40:52,041
If you're looking for an example, Revit 2027.

536
00:40:52,281 --> 00:40:54,521
I'll give you 2 answers then.

537
00:40:54,841 --> 00:41:08,761
One, if it's one that gives you concern from a security perspective, and as much as I love quantitative approaches to things, if it's a qualitative thing, if it makes you feel not right, go call the security group.

538
00:41:09,321 --> 00:41:14,361
and I would treat it just as if you had found something bad inside of the company.

539
00:41:15,201 --> 00:41:16,841
I'm doing vetting and testing right now.

540
00:41:16,841 --> 00:41:23,561
Yeah, there's a process that they will tend to have kind of down for evaluating an existing risk.

541
00:41:23,561 --> 00:41:23,961
Yes.

542
00:41:23,961 --> 00:41:29,641
If you point them at that, the downside to that is that you've maybe raised an emergency flag that

543
00:41:30,521 --> 00:41:36,481
I mean, it may not be a thing, but you're using those very expensive emergency results.

544
00:41:36,481 --> 00:41:40,841
But I think the longer term question is to have something.

545
00:41:41,601 --> 00:41:47,881
Similar to what was described at Pella, which is a real governance program that includes that sort of reporting mechanism.

546
00:41:48,041 --> 00:41:58,041
Yeah, and I'm going through that right now, making sure like my governance rules adhere to certain aspects of the AI assistant that I found work, and then some that do not.

547
00:41:58,121 --> 00:41:59,521
I say don't do that.

548
00:42:00,801 --> 00:42:00,921
Yeah.

549
00:42:01,321 --> 00:42:05,881
I have not seen what I guess I would call like an ideal example.

550
00:42:05,961 --> 00:42:07,721
I think we're still figuring a lot of it out.

551
00:42:08,281 --> 00:42:08,521
Thank you.

552
00:42:08,761 --> 00:42:08,961
Yeah.

553
00:42:11,441 --> 00:42:13,081
I think we have time for one more question.

554
00:42:13,321 --> 00:42:14,761
Is there one more question in the room?

555
00:42:17,081 --> 00:42:17,481
One more.

556
00:42:19,001 --> 00:42:19,401
All right.

557
00:42:19,881 --> 00:42:20,281
Cool.

558
00:42:20,281 --> 00:42:20,401
Yeah.

559
00:42:20,401 --> 00:42:21,001
Thank you.

560
00:42:21,001 --> 00:42:22,361
Thank you so much, you guys.

561
00:42:22,481 --> 00:42:22,681
And